Hi All, In response to several regardings the spreading of the Bofra virus, it is not correct. It was not the work of a virus but a carefully planned hack. The Register just happened to be the site I first noticed the activity on and performed my analysis. I contacted Falk eSolutions AG by telephone to explain to them what was going on. The person I spoke to who clueless about the situation but said he would forward on a message to their support team. After an hour the attack had not stopped so I phoned again. I explained the situation again and he gave me an address to contact their support team on. I sent them a report of how their site was sending Internet Explorer users to the infected search.comedycentral.com site and also sent the same report to The Register. It wasn't until a full day later that The Register published their first report. I received a brief e-mail from a Falk AG support engineer based in the U.K. letting me know he'd received my e-mail but that was it. I've hea rd nothing from them since nor from The Register. I've kept a thread on http://www.finlandforum.org/bb/viewtopic.php?t=7685 documenting what I've found along the way. This is an unpatched exploit and the figures that Falk AG are quoting are incorrect. This attack has been aimed at other sites too so I feel it's much further widespread than is thought. Regards, Matt
